To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files added:
- debian/source/local-options
- network-hooks.d
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2010 Teddy Hogeborn
13
* Copyright © 2008-2010 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
29
* Contact the authors at <mandos@recompile.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
66
67
#include <time.h> /* nanosleep(), time(), sleep() */
67
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
69
SIOCSIFFLAGS, if_indextoname(),
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
84
85
raise() */
85
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
87
91
88
92
#ifdef __linux__
89
93
#include <sys/klog.h> /* klogctl() */
107
111
init_gnutls_session(),
108
112
GNUTLS_* */
109
113
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
111
GNUTLS_OPENPGP_FMT_BASE64 */
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
112
116
113
117
/* GPGME */
114
118
#include <gpgme.h> /* All GPGME types, constants and
122
126
#define PATHDIR "/conf/conf.d/mandos"
123
127
#define SECKEY "seckey.txt"
124
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
125
130
126
131
bool debug = false;
127
132
static const char mandos_protocol_version[] = "1";
128
133
const char *argp_program_version = "mandos-client " VERSION;
129
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
130
135
static const char sys_class_net[] = "/sys/class/net";
131
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
141
const char *ip;
142
uint16_t port;
143
AvahiIfIndex if_index;
144
int af;
145
struct timespec last_seen;
146
struct server *next;
147
struct server *prev;
148
} server;
132
149
133
150
/* Used for passing in values through the Avahi callback functions */
134
151
typedef struct {
139
156
gnutls_dh_params_t dh_params;
140
157
const char *priority;
141
158
gpgme_ctx_t ctx;
159
server *current_server;
142
160
} mandos_context;
143
161
144
162
/* global context so signal handler can reach it*/
145
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
164
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
148
167
149
168
sig_atomic_t quit_now = 0;
150
169
int signal_received = 0;
151
170
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
173
int e = errno;
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
176
errno = e;
177
perror(print_text);
178
}
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
152
190
/*
153
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
192
* bytes. "buffer_capacity" is how much is currently allocated,
155
193
* "buffer_length" is how much is already used.
156
194
*/
157
195
size_t incbuffer(char **buffer, size_t buffer_length,
158
size_t buffer_capacity){
196
size_t buffer_capacity){
159
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
160
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
199
if(buffer == NULL){
166
204
return buffer_capacity;
167
205
}
168
206
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
210
int ret;
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
214
return false;
215
}
216
*new_server = (server){ .ip = strdup(ip),
217
.port = port,
218
.if_index = if_index,
219
.af = af };
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
222
return false;
223
}
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
230
} else {
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
240
}
241
return true;
242
}
243
169
244
/*
170
245
* Initialize GPGME.
171
246
*/
172
static bool init_gpgme(const char *seckey,
173
const char *pubkey, const char *tempdir){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
174
249
gpgme_error_t rc;
175
250
gpgme_engine_info_t engine_info;
176
251
185
260
186
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
187
262
if(fd == -1){
188
perror("open");
263
perror_plus("open");
189
264
return false;
190
265
}
191
266
192
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
268
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
196
271
return false;
197
272
}
198
273
199
274
rc = gpgme_op_import(mc.ctx, pgp_data);
200
275
if(rc != GPG_ERR_NO_ERROR){
201
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
gpgme_strsource(rc), gpgme_strerror(rc));
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
203
278
return false;
204
279
}
205
280
206
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
207
282
if(ret == -1){
208
perror("close");
283
perror_plus("close");
209
284
}
210
285
gpgme_data_release(pgp_data);
211
286
return true;
212
287
}
213
288
214
289
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
290
fprintf_plus(stderr, "Initializing GPGME\n");
216
291
}
217
292
218
293
/* Init GPGME */
219
294
gpgme_check_version(NULL);
220
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
296
if(rc != GPG_ERR_NO_ERROR){
222
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
gpgme_strsource(rc), gpgme_strerror(rc));
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
224
299
return false;
225
300
}
226
301
227
/* Set GPGME home directory for the OpenPGP engine only */
302
/* Set GPGME home directory for the OpenPGP engine only */
228
303
rc = gpgme_get_engine_info(&engine_info);
229
304
if(rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
gpgme_strsource(rc), gpgme_strerror(rc));
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
232
307
return false;
233
308
}
234
309
while(engine_info != NULL){
240
315
engine_info = engine_info->next;
241
316
}
242
317
if(engine_info == NULL){
243
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
244
320
return false;
245
321
}
246
322
247
323
/* Create new GPGME "context" */
248
324
rc = gpgme_new(&(mc.ctx));
249
325
if(rc != GPG_ERR_NO_ERROR){
250
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
gpgme_strsource(rc), gpgme_strerror(rc));
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
252
329
return false;
253
330
}
254
331
273
350
ssize_t plaintext_length = 0;
274
351
275
352
if(debug){
276
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
277
354
}
278
355
279
356
/* Create new GPGME data buffer from memory cryptotext */
280
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
358
0);
282
359
if(rc != GPG_ERR_NO_ERROR){
283
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
gpgme_strsource(rc), gpgme_strerror(rc));
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
285
362
return -1;
286
363
}
287
364
288
365
/* Create new empty GPGME data buffer for the plaintext */
289
366
rc = gpgme_data_new(&dh_plain);
290
367
if(rc != GPG_ERR_NO_ERROR){
291
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
gpgme_strsource(rc), gpgme_strerror(rc));
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
293
371
gpgme_data_release(dh_crypto);
294
372
return -1;
295
373
}
298
376
data buffer */
299
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
378
if(rc != GPG_ERR_NO_ERROR){
301
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
gpgme_strsource(rc), gpgme_strerror(rc));
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
303
381
plaintext_length = -1;
304
382
if(debug){
305
383
gpgme_decrypt_result_t result;
306
384
result = gpgme_op_decrypt_result(mc.ctx);
307
385
if(result == NULL){
308
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
309
387
} else {
310
fprintf(stderr, "Unsupported algorithm: %s\n",
311
result->unsupported_algorithm);
312
fprintf(stderr, "Wrong key usage: %u\n",
313
result->wrong_key_usage);
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
314
392
if(result->file_name != NULL){
315
fprintf(stderr, "File name: %s\n", result->file_name);
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
316
394
}
317
395
gpgme_recipient_t recipient;
318
396
recipient = result->recipients;
319
397
while(recipient != NULL){
320
fprintf(stderr, "Public key algorithm: %s\n",
321
gpgme_pubkey_algo_name(recipient->pubkey_algo));
322
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
323
fprintf(stderr, "Secret key available: %s\n",
324
recipient->status == GPG_ERR_NO_SECKEY
325
? "No" : "Yes");
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
326
405
recipient = recipient->next;
327
406
}
328
407
}
331
410
}
332
411
333
412
if(debug){
334
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
335
414
}
336
415
337
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
339
perror("gpgme_data_seek");
418
perror_plus("gpgme_data_seek");
340
419
plaintext_length = -1;
341
420
goto decrypt_end;
342
421
}
344
423
*plaintext = NULL;
345
424
while(true){
346
425
plaintext_capacity = incbuffer(plaintext,
347
(size_t)plaintext_length,
348
plaintext_capacity);
426
(size_t)plaintext_length,
427
plaintext_capacity);
349
428
if(plaintext_capacity == 0){
350
perror("incbuffer");
351
plaintext_length = -1;
352
goto decrypt_end;
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
353
432
}
354
433
355
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
360
439
break;
361
440
}
362
441
if(ret < 0){
363
perror("gpgme_data_read");
442
perror_plus("gpgme_data_read");
364
443
plaintext_length = -1;
365
444
goto decrypt_end;
366
445
}
368
447
}
369
448
370
449
if(debug){
371
fprintf(stderr, "Decrypted password is: ");
450
fprintf_plus(stderr, "Decrypted password is: ");
372
451
for(ssize_t i = 0; i < plaintext_length; i++){
373
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
374
453
}
396
475
/* GnuTLS log function callback */
397
476
static void debuggnutls(__attribute__((unused)) int level,
398
477
const char* string){
399
fprintf(stderr, "GnuTLS: %s", string);
478
fprintf_plus(stderr, "GnuTLS: %s", string);
400
479
}
401
480
402
481
static int init_gnutls_global(const char *pubkeyfilename,
404
483
int ret;
405
484
406
485
if(debug){
407
fprintf(stderr, "Initializing GnuTLS\n");
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
408
487
}
409
488
410
489
ret = gnutls_global_init();
411
490
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
414
493
return -1;
415
494
}
416
495
423
502
}
424
503
425
504
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
427
506
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
433
509
gnutls_global_deinit();
434
510
return -1;
435
511
}
436
512
437
513
if(debug){
438
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
439
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
440
seckeyfilename);
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
441
518
}
442
519
443
520
ret = gnutls_certificate_set_openpgp_key_file
444
521
(mc.cred, pubkeyfilename, seckeyfilename,
445
522
GNUTLS_OPENPGP_FMT_BASE64);
446
523
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr,
448
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
450
fprintf(stderr, "The GnuTLS error is: %s\n",
451
safer_gnutls_strerror(ret));
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
452
529
goto globalfail;
453
530
}
454
531
455
532
/* GnuTLS server initialization */
456
533
ret = gnutls_dh_params_init(&mc.dh_params);
457
534
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
460
538
goto globalfail;
461
539
}
462
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
541
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
466
544
goto globalfail;
467
545
}
468
546
488
566
}
489
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
568
if(ret != GNUTLS_E_SUCCESS){
491
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
safer_gnutls_strerror(ret));
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
493
572
}
494
573
495
574
{
502
581
}
503
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
583
if(ret != GNUTLS_E_SUCCESS){
505
fprintf(stderr, "Syntax error at: %s\n", err);
506
fprintf(stderr, "GnuTLS error: %s\n",
507
safer_gnutls_strerror(ret));
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
508
587
gnutls_deinit(*session);
509
588
return -1;
510
589
}
519
598
}
520
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
600
if(ret != GNUTLS_E_SUCCESS){
522
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
523
safer_gnutls_strerror(ret));
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
524
603
gnutls_deinit(*session);
525
604
return -1;
526
605
}
571
650
pf = PF_INET;
572
651
break;
573
652
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
575
654
errno = EINVAL;
576
655
return -1;
577
656
}
582
661
}
583
662
584
663
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
586
"\n", ip, port);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
587
666
}
588
667
589
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
669
if(tcp_sd < 0){
591
670
int e = errno;
592
perror("socket");
671
perror_plus("socket");
593
672
errno = e;
594
673
goto mandos_end;
595
674
}
609
688
}
610
689
if(ret < 0 ){
611
690
int e = errno;
612
perror("inet_pton");
691
perror_plus("inet_pton");
613
692
errno = e;
614
693
goto mandos_end;
615
694
}
616
695
if(ret == 0){
617
696
int e = errno;
618
fprintf(stderr, "Bad address: %s\n", ip);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
619
698
errno = e;
620
699
goto mandos_end;
621
700
}
626
705
627
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
708
-Wunreachable-code*/
630
709
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
633
712
errno = EINVAL;
634
713
goto mandos_end;
635
714
}
651
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
731
char interface[IF_NAMESIZE];
653
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
733
perror_plus("if_indextoname");
655
734
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
658
737
}
659
738
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
662
741
}
663
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
671
750
sizeof(addrstr));
672
751
}
673
752
if(pcret == NULL){
674
perror("inet_ntop");
753
perror_plus("inet_ntop");
675
754
} else {
676
755
if(strcmp(addrstr, ip) != 0){
677
fprintf(stderr, "Canonical address form: %s\n", addrstr);
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
678
757
}
679
758
}
680
759
}
692
771
if(ret < 0){
693
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
694
773
int e = errno;
695
perror("connect");
774
perror_plus("connect");
696
775
errno = e;
697
776
}
698
777
goto mandos_end;
708
787
while(true){
709
788
size_t out_size = strlen(out);
710
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
out_size - written));
790
out_size - written));
712
791
if(ret == -1){
713
792
int e = errno;
714
perror("write");
793
perror_plus("write");
715
794
errno = e;
716
795
goto mandos_end;
717
796
}
734
813
}
735
814
736
815
if(debug){
737
fprintf(stderr, "Establishing TLS session with %s\n", ip);
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
738
817
}
739
818
740
819
if(quit_now){
742
821
goto mandos_end;
743
822
}
744
823
824
/* Spurious warning from -Wint-to-pointer-cast */
745
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
746
826
747
827
if(quit_now){
759
839
760
840
if(ret != GNUTLS_E_SUCCESS){
761
841
if(debug){
762
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
842
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
763
843
gnutls_perror(ret);
764
844
}
765
845
errno = EPROTO;
769
849
/* Read OpenPGP packet that contains the wanted password */
770
850
771
851
if(debug){
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
773
ip);
852
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
853
" %s\n", ip);
774
854
}
775
855
776
856
while(true){
781
861
}
782
862
783
863
buffer_capacity = incbuffer(&buffer, buffer_length,
784
buffer_capacity);
864
buffer_capacity);
785
865
if(buffer_capacity == 0){
786
866
int e = errno;
787
perror("incbuffer");
867
perror_plus("incbuffer");
788
868
errno = e;
789
869
goto mandos_end;
790
870
}
814
894
}
815
895
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
896
if(ret < 0){
817
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
897
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
898
"***\n");
818
899
gnutls_perror(ret);
819
900
errno = EPROTO;
820
901
goto mandos_end;
821
902
}
822
903
break;
823
904
default:
824
fprintf(stderr, "Unknown error while reading data from"
825
" encrypted session with Mandos server\n");
905
fprintf_plus(stderr, "Unknown error while reading data from"
906
" encrypted session with Mandos server\n");
826
907
gnutls_bye(session, GNUTLS_SHUT_RDWR);
827
908
errno = EIO;
828
909
goto mandos_end;
833
914
}
834
915
835
916
if(debug){
836
fprintf(stderr, "Closing TLS session\n");
917
fprintf_plus(stderr, "Closing TLS session\n");
837
918
}
838
919
839
920
if(quit_now){
851
932
852
933
if(buffer_length > 0){
853
934
ssize_t decrypted_buffer_size;
854
decrypted_buffer_size = pgp_packet_decrypt(buffer,
855
buffer_length,
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
856
936
&decrypted_buffer);
857
937
if(decrypted_buffer_size >= 0){
858
938
869
949
if(ret == 0 and ferror(stdout)){
870
950
int e = errno;
871
951
if(debug){
872
fprintf(stderr, "Error writing encrypted data: %s\n",
873
strerror(errno));
952
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
953
strerror(errno));
874
954
}
875
955
errno = e;
876
956
goto mandos_end;
895
975
if(e == 0){
896
976
e = errno;
897
977
}
898
perror("close");
978
perror_plus("close");
899
979
}
900
980
gnutls_deinit(session);
981
errno = e;
901
982
if(quit_now){
902
e = EINTR;
983
errno = EINTR;
903
984
retval = -1;
904
985
}
905
errno = e;
906
986
}
907
987
return retval;
908
988
}
933
1013
switch(event){
934
1014
default:
935
1015
case AVAHI_RESOLVER_FAILURE:
936
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1018
domain,
1019
avahi_strerror(avahi_server_errno(mc.server)));
939
1020
break;
940
1021
941
1022
case AVAHI_RESOLVER_FOUND:
943
1024
char ip[AVAHI_ADDRESS_STR_MAX];
944
1025
avahi_address_snprint(ip, sizeof(ip), address);
945
1026
if(debug){
946
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
1027
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
host_name, ip, (intmax_t)interface, port);
949
1030
}
950
1031
int ret = start_mandos_communication(ip, port, interface,
951
1032
avahi_proto_to_af(proto));
952
1033
if(ret == 0){
953
1034
avahi_simple_poll_quit(mc.simple_poll);
1035
} else {
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1039
" list\n", name);
1040
}
954
1041
}
955
1042
}
956
1043
}
980
1067
default:
981
1068
case AVAHI_BROWSER_FAILURE:
982
1069
983
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1071
avahi_strerror(avahi_server_errno(mc.server)));
985
1072
avahi_simple_poll_quit(mc.simple_poll);
986
1073
return;
987
1074
994
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
1082
name, type, domain, protocol, 0,
996
1083
resolve_callback, NULL) == NULL)
997
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1085
" %s\n", name,
1086
avahi_strerror(avahi_server_errno(mc.server)));
999
1087
break;
1000
1088
1001
1089
case AVAHI_BROWSER_REMOVE:
1004
1092
case AVAHI_BROWSER_ALL_FOR_NOW:
1005
1093
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1006
1094
if(debug){
1007
fprintf(stderr, "No Mandos server found, still searching...\n");
1095
fprintf_plus(stderr, "No Mandos server found, still"
1096
" searching...\n");
1008
1097
}
1009
1098
break;
1010
1099
}
1011
1100
}
1012
1101
1013
/* stop main loop after sigterm has been called */
1102
/* Signal handler that stops main loop after SIGTERM */
1014
1103
static void handle_sigterm(int sig){
1015
1104
if(quit_now){
1016
1105
return;
1018
1107
quit_now = 1;
1019
1108
signal_received = sig;
1020
1109
int old_errno = errno;
1110
/* set main loop to exit */
1021
1111
if(mc.simple_poll != NULL){
1022
1112
avahi_simple_poll_quit(mc.simple_poll);
1023
1113
}
1024
1114
errno = old_errno;
1025
1115
}
1026
1116
1027
/*
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1031
*/
1032
int good_interface(const struct dirent *if_entry){
1033
ssize_t ssret;
1034
char *flagname = NULL;
1035
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1036
if_entry->d_name);
1037
if(ret < 0){
1038
perror("asprintf");
1039
return 0;
1040
}
1041
if(if_entry->d_name[0] == '.'){
1042
return 0;
1043
}
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1045
if(flags_fd == -1){
1046
perror("open");
1047
return 0;
1048
}
1049
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1050
/* read line from flags_fd */
1051
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1052
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1053
flagstring[(size_t)to_read] = '\0';
1054
if(flagstring == NULL){
1055
perror("malloc");
1056
close(flags_fd);
1057
return 0;
1058
}
1059
while(to_read > 0){
1060
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1061
(size_t)to_read));
1062
if(ssret == -1){
1063
perror("read");
1064
free(flagstring);
1065
close(flags_fd);
1066
return 0;
1067
}
1068
to_read -= ssret;
1069
if(ssret == 0){
1070
break;
1071
}
1072
}
1073
close(flags_fd);
1074
intmax_t tmpmax;
1075
char *tmp;
1076
errno = 0;
1077
tmpmax = strtoimax(flagstring, &tmp, 0);
1078
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1079
and not (isspace(*tmp)))
1080
or tmpmax != (ifreq_flags)tmpmax){
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1118
int ret;
1119
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1121
if(s < 0){
1122
perror_plus("socket");
1123
return false;
1124
}
1125
strcpy(ifr->ifr_name, ifname);
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1127
if(ret == -1){
1081
1128
if(debug){
1082
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1083
flagstring, if_entry->d_name);
1129
perror_plus("ioctl SIOCGIFFLAGS");
1084
1130
}
1085
free(flagstring);
1086
return 0;
1131
return false;
1087
1132
}
1088
free(flagstring);
1089
ifreq_flags flags = (ifreq_flags)tmpmax;
1133
return true;
1134
}
1135
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1137
1090
1138
/* Reject the loopback device */
1091
if(flags & IFF_LOOPBACK){
1139
if(ifr->ifr_flags & IFF_LOOPBACK){
1092
1140
if(debug){
1093
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1094
if_entry->d_name);
1141
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1142
ifname);
1095
1143
}
1096
return 0;
1144
return false;
1097
1145
}
1098
1146
/* Accept point-to-point devices only if connect_to is specified */
1099
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1147
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1100
1148
if(debug){
1101
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1102
if_entry->d_name);
1149
fprintf_plus(stderr, "Accepting point-to-point interface"
1150
" \"%s\"\n", ifname);
1103
1151
}
1104
return 1;
1152
return true;
1105
1153
}
1106
1154
/* Otherwise, reject non-broadcast-capable devices */
1107
if(not (flags & IFF_BROADCAST)){
1108
if(debug){
1109
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1110
if_entry->d_name);
1111
}
1112
return 0;
1113
}
1155
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1156
if(debug){
1157
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1158
" \"%s\"\n", ifname);
1159
}
1160
return false;
1161
}
1162
/* Reject non-ARP interfaces (including dummy interfaces) */
1163
if(ifr->ifr_flags & IFF_NOARP){
1164
if(debug){
1165
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1166
ifname);
1167
}
1168
return false;
1169
}
1170
1114
1171
/* Accept this device */
1115
1172
if(debug){
1116
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1117
if_entry->d_name);
1118
}
1119
return 1;
1173
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1174
}
1175
return true;
1176
}
1177
1178
/*
1179
* This function determines if a directory entry in /sys/class/net
1180
* corresponds to an acceptable network device.
1181
* (This function is passed to scandir(3) as a filter function.)
1182
*/
1183
int good_interface(const struct dirent *if_entry){
1184
if(if_entry->d_name[0] == '.'){
1185
return 0;
1186
}
1187
1188
struct ifreq ifr;
1189
if(not get_flags(if_entry->d_name, &ifr)){
1190
if(debug){
1191
fprintf_plus(stderr, "Failed to get flags for interface "
1192
"\"%s\"\n", if_entry->d_name);
1193
}
1194
return 0;
1195
}
1196
1197
if(not good_flags(if_entry->d_name, &ifr)){
1198
return 0;
1199
}
1200
return 1;
1201
}
1202
1203
/*
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1244
}
1245
1246
int notdotentries(const struct dirent *direntry){
1247
/* Skip "." and ".." */
1248
if(direntry->d_name[0] == '.'
1249
and (direntry->d_name[1] == '\0'
1250
or (direntry->d_name[1] == '.'
1251
and direntry->d_name[2] == '\0'))){
1252
return 0;
1253
}
1254
return 1;
1255
}
1256
1257
/* Is this directory entry a runnable program? */
1258
int runnable_hook(const struct dirent *direntry){
1259
int ret;
1260
size_t sret;
1261
struct stat st;
1262
1263
if((direntry->d_name)[0] == '\0'){
1264
/* Empty name? */
1265
return 0;
1266
}
1267
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1269
"abcdefghijklmnopqrstuvwxyz"
1270
"0123456789"
1271
"_-");
1272
if((direntry->d_name)[sret] != '\0'){
1273
/* Contains non-allowed characters */
1274
if(debug){
1275
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1276
direntry->d_name);
1277
}
1278
return 0;
1279
}
1280
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1283
if(ret < 0){
1284
perror_plus("asprintf");
1285
return 0;
1286
}
1287
1288
ret = stat(fullname, &st);
1289
if(ret == -1){
1290
if(debug){
1291
perror_plus("Could not stat hook");
1292
}
1293
return 0;
1294
}
1295
if(not (S_ISREG(st.st_mode))){
1296
/* Not a regular file */
1297
if(debug){
1298
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1299
direntry->d_name);
1300
}
1301
return 0;
1302
}
1303
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1304
/* Not executable */
1305
if(debug){
1306
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1307
direntry->d_name);
1308
}
1309
return 0;
1310
}
1311
if(debug){
1312
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1313
direntry->d_name);
1314
}
1315
return 1;
1316
}
1317
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1319
int ret;
1320
struct timespec now;
1321
struct timespec waited_time;
1322
intmax_t block_time;
1323
1324
while(true){
1325
if(mc.current_server == NULL){
1326
if (debug){
1327
fprintf_plus(stderr, "Wait until first server is found."
1328
" No timeout!\n");
1329
}
1330
ret = avahi_simple_poll_iterate(s, -1);
1331
} else {
1332
if (debug){
1333
fprintf_plus(stderr, "Check current_server if we should run"
1334
" it, or wait\n");
1335
}
1336
/* the current time */
1337
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1338
if(ret == -1){
1339
perror_plus("clock_gettime");
1340
return -1;
1341
}
1342
/* Calculating in ms how long time between now and server
1343
who we visted longest time ago. Now - last seen. */
1344
waited_time.tv_sec = (now.tv_sec
1345
- mc.current_server->last_seen.tv_sec);
1346
waited_time.tv_nsec = (now.tv_nsec
1347
- mc.current_server->last_seen.tv_nsec);
1348
/* total time is 10s/10,000ms.
1349
Converting to s from ms by dividing by 1,000,
1350
and ns to ms by dividing by 1,000,000. */
1351
block_time = ((retry_interval
1352
- ((intmax_t)waited_time.tv_sec * 1000))
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1354
1355
if (debug){
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1357
block_time);
1358
}
1359
1360
if(block_time <= 0){
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1365
if(ret == 0){
1366
avahi_simple_poll_quit(mc.simple_poll);
1367
return 0;
1368
}
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1370
&mc.current_server->last_seen);
1371
if(ret == -1){
1372
perror_plus("clock_gettime");
1373
return -1;
1374
}
1375
mc.current_server = mc.current_server->next;
1376
block_time = 0; /* Call avahi to find new Mandos
1377
servers, but don't block */
1378
}
1379
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1381
}
1382
if(ret != 0){
1383
if (ret > 0 or errno != EINTR){
1384
return (ret != 1) ? ret : 0;
1385
}
1386
}
1387
}
1388
}
1389
1390
bool run_network_hooks(const char *mode, const char *interface,
1391
const float delay){
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1394
int ret;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1396
alphasort);
1397
if(numhooks == -1){
1398
perror_plus("scandir");
1399
} else {
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1405
if(ret < 0){
1406
perror_plus("asprintf");
1407
continue;
1408
}
1409
if(debug){
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1411
direntry->d_name);
1412
}
1413
pid_t hook_pid = fork();
1414
if(hook_pid == 0){
1415
/* Child */
1416
/* Raise privileges */
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1428
/* Set group */
1429
errno = 0;
1430
ret = setgid(0);
1431
if(ret == -1){
1432
perror_plus("setgid");
1433
}
1434
/* Reset supplementary groups */
1435
errno = 0;
1436
ret = setgroups(0, NULL);
1437
if(ret == -1){
1438
perror_plus("setgroups");
1439
}
1440
dup2(devnull, STDIN_FILENO);
1441
close(devnull);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1444
if(ret == -1){
1445
perror_plus("setenv");
1446
_exit(EX_OSERR);
1447
}
1448
ret = setenv("DEVICE", interface, 1);
1449
if(ret == -1){
1450
perror_plus("setenv");
1451
_exit(EX_OSERR);
1452
}
1453
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1454
if(ret == -1){
1455
perror_plus("setenv");
1456
_exit(EX_OSERR);
1457
}
1458
ret = setenv("MODE", mode, 1);
1459
if(ret == -1){
1460
perror_plus("setenv");
1461
_exit(EX_OSERR);
1462
}
1463
char *delaystring;
1464
ret = asprintf(&delaystring, "%f", delay);
1465
if(ret == -1){
1466
perror_plus("asprintf");
1467
_exit(EX_OSERR);
1468
}
1469
ret = setenv("DELAY", delaystring, 1);
1470
if(ret == -1){
1471
free(delaystring);
1472
perror_plus("setenv");
1473
_exit(EX_OSERR);
1474
}
1475
free(delaystring);
1476
if(connect_to != NULL){
1477
ret = setenv("CONNECT", connect_to, 1);
1478
if(ret == -1){
1479
perror_plus("setenv");
1480
_exit(EX_OSERR);
1481
}
1482
}
1483
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1484
perror_plus("execl");
1485
_exit(EXIT_FAILURE);
1486
}
1487
} else {
1488
int status;
1489
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1490
perror_plus("waitpid");
1491
free(fullname);
1492
continue;
1493
}
1494
if(WIFEXITED(status)){
1495
if(WEXITSTATUS(status) != 0){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1497
" with status %d\n", direntry->d_name,
1498
WEXITSTATUS(status));
1499
free(fullname);
1500
continue;
1501
}
1502
} else if(WIFSIGNALED(status)){
1503
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1504
" signal %d\n", direntry->d_name,
1505
WTERMSIG(status));
1506
free(fullname);
1507
continue;
1508
} else {
1509
fprintf_plus(stderr, "Warning: network hook \"%s\""
1510
" crashed\n", direntry->d_name);
1511
free(fullname);
1512
continue;
1513
}
1514
}
1515
free(fullname);
1516
if(debug){
1517
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1518
direntry->d_name);
1519
}
1520
}
1521
close(devnull);
1522
}
1523
return true;
1120
1524
}
1121
1525
1122
1526
int main(int argc, char *argv[]){
1141
1545
bool gnutls_initialized = false;
1142
1546
bool gpgme_initialized = false;
1143
1547
float delay = 2.5f;
1548
double retry_interval = 10; /* 10s between trying a server and
1549
retrying the same server again */
1144
1550
1145
1551
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1146
1552
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1152
1558
errno = 0;
1153
1559
ret = setgid(gid);
1154
1560
if(ret == -1){
1155
perror("setgid");
1561
perror_plus("setgid");
1156
1562
}
1157
1563
1158
1564
/* Lower user privileges (temporarily) */
1159
1565
errno = 0;
1160
1566
ret = seteuid(uid);
1161
1567
if(ret == -1){
1162
perror("seteuid");
1568
perror_plus("seteuid");
1163
1569
}
1164
1570
1165
1571
if(quit_now){
1200
1606
.arg = "SECONDS",
1201
1607
.doc = "Maximum delay to wait for interface startup",
1202
1608
.group = 2 },
1609
{ .name = "retry", .key = 132,
1610
.arg = "SECONDS",
1611
.doc = "Retry interval used when denied by the Mandos server",
1612
.group = 2 },
1613
{ .name = "network-hook-dir", .key = 133,
1614
.arg = "DIR",
1615
.doc = "Directory where network hooks are located",
1616
.group = 2 },
1203
1617
/*
1204
1618
* These reproduce what we would get without ARGP_NO_HELP
1205
1619
*/
1249
1663
if(errno != 0 or tmp == arg or *tmp != '\0'){
1250
1664
argp_error(state, "Bad delay");
1251
1665
}
1666
case 132: /* --retry */
1667
errno = 0;
1668
retry_interval = strtod(arg, &tmp);
1669
if(errno != 0 or tmp == arg or *tmp != '\0'
1670
or (retry_interval * 1000) > INT_MAX
1671
or retry_interval < 0){
1672
argp_error(state, "Bad retry interval");
1673
}
1674
break;
1675
case 133: /* --network-hook-dir */
1676
hookdir = arg;
1252
1677
break;
1253
1678
/*
1254
1679
* These reproduce what we would get without ARGP_NO_HELP
1261
1686
argp_state_help(state, state->out_stream,
1262
1687
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1263
1688
case 'V': /* --version */
1264
fprintf(state->out_stream, "%s\n", argp_program_version);
1689
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1265
1690
exit(argp_err_exit_status);
1266
1691
break;
1267
1692
default:
1282
1707
case ENOMEM:
1283
1708
default:
1284
1709
errno = ret;
1285
perror("argp_parse");
1710
perror_plus("argp_parse");
1286
1711
exitcode = EX_OSERR;
1287
1712
goto end;
1288
1713
case EINVAL:
1290
1715
goto end;
1291
1716
}
1292
1717
}
1718
1719
{
1720
/* Work around Debian bug #633582:
1721
<http://bugs.debian.org/633582> */
1722
1723
/* Re-raise priviliges */
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1729
struct stat st;
1730
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1732
int seckey_fd = open(seckey, O_RDONLY);
1733
if(seckey_fd == -1){
1734
perror_plus("open");
1735
} else {
1736
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1737
if(ret == -1){
1738
perror_plus("fstat");
1739
} else {
1740
if(S_ISREG(st.st_mode)
1741
and st.st_uid == 0 and st.st_gid == 0){
1742
ret = fchown(seckey_fd, uid, gid);
1743
if(ret == -1){
1744
perror_plus("fchown");
1745
}
1746
}
1747
}
1748
TEMP_FAILURE_RETRY(close(seckey_fd));
1749
}
1750
}
1751
1752
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1753
int pubkey_fd = open(pubkey, O_RDONLY);
1754
if(pubkey_fd == -1){
1755
perror_plus("open");
1756
} else {
1757
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1758
if(ret == -1){
1759
perror_plus("fstat");
1760
} else {
1761
if(S_ISREG(st.st_mode)
1762
and st.st_uid == 0 and st.st_gid == 0){
1763
ret = fchown(pubkey_fd, uid, gid);
1764
if(ret == -1){
1765
perror_plus("fchown");
1766
}
1767
}
1768
}
1769
TEMP_FAILURE_RETRY(close(pubkey_fd));
1770
}
1771
}
1772
1773
/* Lower privileges */
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
1778
}
1779
}
1780
}
1781
1782
/* Run network hooks */
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
1785
}
1293
1786
1294
1787
if(not debug){
1295
1788
avahi_set_log_function(empty_log);
1296
1789
}
1297
1790
1298
1791
if(interface[0] == '\0'){
1299
1792
struct dirent **direntries;
1300
ret = scandir(sys_class_net, &direntries, good_interface,
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1301
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1302
1802
if(ret >= 1){
1303
/* Pick the first good interface */
1803
/* Pick the first interface returned */
1304
1804
interface = strdup(direntries[0]->d_name);
1305
1805
if(debug){
1306
fprintf(stderr, "Using interface \"%s\"\n", interface);
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1307
1807
}
1308
1808
if(interface == NULL){
1309
perror("malloc");
1809
perror_plus("malloc");
1310
1810
free(direntries);
1311
1811
exitcode = EXIT_FAILURE;
1312
1812
goto end;
1314
1814
free(direntries);
1315
1815
} else {
1316
1816
free(direntries);
1317
fprintf(stderr, "Could not find a network interface\n");
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1318
1818
exitcode = EXIT_FAILURE;
1319
1819
goto end;
1320
1820
}
1326
1826
srand((unsigned int) time(NULL));
1327
1827
mc.simple_poll = avahi_simple_poll_new();
1328
1828
if(mc.simple_poll == NULL){
1329
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1829
fprintf_plus(stderr,
1830
"Avahi: Failed to create simple poll object.\n");
1330
1831
exitcode = EX_UNAVAILABLE;
1331
1832
goto end;
1332
1833
}
1334
1835
sigemptyset(&sigterm_action.sa_mask);
1335
1836
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1336
1837
if(ret == -1){
1337
perror("sigaddset");
1838
perror_plus("sigaddset");
1338
1839
exitcode = EX_OSERR;
1339
1840
goto end;
1340
1841
}
1341
1842
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1342
1843
if(ret == -1){
1343
perror("sigaddset");
1844
perror_plus("sigaddset");
1344
1845
exitcode = EX_OSERR;
1345
1846
goto end;
1346
1847
}
1347
1848
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1348
1849
if(ret == -1){
1349
perror("sigaddset");
1850
perror_plus("sigaddset");
1350
1851
exitcode = EX_OSERR;
1351
1852
goto end;
1352
1853
}
1356
1857
*/
1357
1858
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1358
1859
if(ret == -1){
1359
perror("sigaction");
1860
perror_plus("sigaction");
1360
1861
return EX_OSERR;
1361
1862
}
1362
1863
if(old_sigterm_action.sa_handler != SIG_IGN){
1363
1864
ret = sigaction(SIGINT, &sigterm_action, NULL);
1364
1865
if(ret == -1){
1365
perror("sigaction");
1866
perror_plus("sigaction");
1366
1867
exitcode = EX_OSERR;
1367
1868
goto end;
1368
1869
}
1369
1870
}
1370
1871
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1371
1872
if(ret == -1){
1372
perror("sigaction");
1873
perror_plus("sigaction");
1373
1874
return EX_OSERR;
1374
1875
}
1375
1876
if(old_sigterm_action.sa_handler != SIG_IGN){
1376
1877
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1377
1878
if(ret == -1){
1378
perror("sigaction");
1879
perror_plus("sigaction");
1379
1880
exitcode = EX_OSERR;
1380
1881
goto end;
1381
1882
}
1382
1883
}
1383
1884
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1384
1885
if(ret == -1){
1385
perror("sigaction");
1886
perror_plus("sigaction");
1386
1887
return EX_OSERR;
1387
1888
}
1388
1889
if(old_sigterm_action.sa_handler != SIG_IGN){
1389
1890
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1390
1891
if(ret == -1){
1391
perror("sigaction");
1892
perror_plus("sigaction");
1392
1893
exitcode = EX_OSERR;
1393
1894
goto end;
1394
1895
}
1398
1899
if(strcmp(interface, "none") != 0){
1399
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1400
1901
if(if_index == 0){
1401
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1402
1903
exitcode = EX_UNAVAILABLE;
1403
1904
goto end;
1404
1905
}
1411
1912
errno = 0;
1412
1913
ret = seteuid(0);
1413
1914
if(ret == -1){
1414
perror("seteuid");
1915
perror_plus("seteuid");
1415
1916
}
1416
1917
1417
1918
#ifdef __linux__
1421
1922
bool restore_loglevel = true;
1422
1923
if(ret == -1){
1423
1924
restore_loglevel = false;
1424
perror("klogctl");
1925
perror_plus("klogctl");
1425
1926
}
1426
1927
#endif /* __linux__ */
1427
1928
1428
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1429
1930
if(sd < 0){
1430
perror("socket");
1931
perror_plus("socket");
1431
1932
exitcode = EX_OSERR;
1432
1933
#ifdef __linux__
1433
1934
if(restore_loglevel){
1434
1935
ret = klogctl(7, NULL, 0);
1435
1936
if(ret == -1){
1436
perror("klogctl");
1937
perror_plus("klogctl");
1437
1938
}
1438
1939
}
1439
1940
#endif /* __linux__ */
1441
1942
errno = 0;
1442
1943
ret = seteuid(uid);
1443
1944
if(ret == -1){
1444
perror("seteuid");
1945
perror_plus("seteuid");
1445
1946
}
1446
1947
goto end;
1447
1948
}
1448
1949
strcpy(network.ifr_name, interface);
1449
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1450
1951
if(ret == -1){
1451
perror("ioctl SIOCGIFFLAGS");
1952
perror_plus("ioctl SIOCGIFFLAGS");
1452
1953
#ifdef __linux__
1453
1954
if(restore_loglevel){
1454
1955
ret = klogctl(7, NULL, 0);
1455
1956
if(ret == -1){
1456
perror("klogctl");
1957
perror_plus("klogctl");
1457
1958
}
1458
1959
}
1459
1960
#endif /* __linux__ */
1462
1963
errno = 0;
1463
1964
ret = seteuid(uid);
1464
1965
if(ret == -1){
1465
perror("seteuid");
1966
perror_plus("seteuid");
1466
1967
}
1467
1968
goto end;
1468
1969
}
1472
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1473
1974
if(ret == -1){
1474
1975
take_down_interface = false;
1475
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1476
1977
exitcode = EX_OSERR;
1477
1978
#ifdef __linux__
1478
1979
if(restore_loglevel){
1479
1980
ret = klogctl(7, NULL, 0);
1480
1981
if(ret == -1){
1481
perror("klogctl");
1982
perror_plus("klogctl");
1482
1983
}
1483
1984
}
1484
1985
#endif /* __linux__ */
1486
1987
errno = 0;
1487
1988
ret = seteuid(uid);
1488
1989
if(ret == -1){
1489
perror("seteuid");
1990
perror_plus("seteuid");
1490
1991
}
1491
1992
goto end;
1492
1993
}
1493
1994
}
1494
/* sleep checking until interface is running */
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1495
1997
for(int i=0; i < delay * 4; i++){
1496
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
1999
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
2000
perror_plus("ioctl SIOCGIFFLAGS");
1499
2001
} else if(network.ifr_flags & IFF_RUNNING){
1500
2002
break;
1501
2003
}
1502
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
1503
2005
ret = nanosleep(&sleeptime, NULL);
1504
2006
if(ret == -1 and errno != EINTR){
1505
perror("nanosleep");
2007
perror_plus("nanosleep");
1506
2008
}
1507
2009
}
1508
2010
if(not take_down_interface){
1509
2011
/* We won't need the socket anymore */
1510
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1511
2013
if(ret == -1){
1512
perror("close");
2014
perror_plus("close");
1513
2015
}
1514
2016
}
1515
2017
#ifdef __linux__
1517
2019
/* Restores kernel loglevel to default */
1518
2020
ret = klogctl(7, NULL, 0);
1519
2021
if(ret == -1){
1520
perror("klogctl");
2022
perror_plus("klogctl");
1521
2023
}
1522
2024
}
1523
2025
#endif /* __linux__ */
1524
2026
/* Lower privileges */
1525
2027
errno = 0;
1526
if(take_down_interface){
1527
/* Lower privileges */
1528
ret = seteuid(uid);
1529
if(ret == -1){
1530
perror("seteuid");
1531
}
1532
} else {
1533
/* Lower privileges permanently */
1534
ret = setuid(uid);
1535
if(ret == -1){
1536
perror("setuid");
1537
}
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
1538
2032
}
1539
2033
}
1540
2034
1544
2038
1545
2039
ret = init_gnutls_global(pubkey, seckey);
1546
2040
if(ret == -1){
1547
fprintf(stderr, "init_gnutls_global failed\n");
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
1548
2042
exitcode = EX_UNAVAILABLE;
1549
2043
goto end;
1550
2044
} else {
1555
2049
goto end;
1556
2050
}
1557
2051
2052
if(mkdtemp(tempdir) == NULL){
2053
perror_plus("mkdtemp");
2054
goto end;
2055
}
1558
2056
tempdir_created = true;
1559
if(mkdtemp(tempdir) == NULL){
1560
tempdir_created = false;
1561
perror("mkdtemp");
1562
goto end;
1563
}
1564
2057
1565
2058
if(quit_now){
1566
2059
goto end;
1567
2060
}
1568
2061
1569
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
1570
fprintf(stderr, "init_gpgme failed\n");
2063
fprintf_plus(stderr, "init_gpgme failed\n");
1571
2064
exitcode = EX_UNAVAILABLE;
1572
2065
goto end;
1573
2066
} else {
1583
2076
/* (Mainly meant for debugging) */
1584
2077
char *address = strrchr(connect_to, ':');
1585
2078
if(address == NULL){
1586
fprintf(stderr, "No colon in address\n");
2079
fprintf_plus(stderr, "No colon in address\n");
1587
2080
exitcode = EX_USAGE;
1588
2081
goto end;
1589
2082
}
1597
2090
tmpmax = strtoimax(address+1, &tmp, 10);
1598
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1599
2092
or tmpmax != (uint16_t)tmpmax){
1600
fprintf(stderr, "Bad port number\n");
2093
fprintf_plus(stderr, "Bad port number\n");
1601
2094
exitcode = EX_USAGE;
1602
2095
goto end;
1603
2096
}
1608
2101
1609
2102
port = (uint16_t)tmpmax;
1610
2103
*address = '\0';
1611
address = connect_to;
1612
2104
/* Colon in address indicates IPv6 */
1613
2105
int af;
1614
if(strchr(address, ':') != NULL){
2106
if(strchr(connect_to, ':') != NULL){
1615
2107
af = AF_INET6;
2108
/* Accept [] around IPv6 address - see RFC 5952 */
2109
if(connect_to[0] == '[' and address[-1] == ']')
2110
{
2111
connect_to++;
2112
address[-1] = '\0';
2113
}
1616
2114
} else {
1617
2115
af = AF_INET;
1618
2116
}
2117
address = connect_to;
1619
2118
1620
2119
if(quit_now){
1621
2120
goto end;
1622
2121
}
1623
2122
1624
2123
while(not quit_now){
1625
2124
ret = start_mandos_communication(address, port, if_index, af);
1626
2125
if(quit_now or ret == 0){
1627
2126
break;
1628
2127
}
1629
sleep(15);
1630
};
1631
2128
if(debug){
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2130
(int)retry_interval);
2131
}
2132
sleep((int)retry_interval);
2133
}
2134
1632
2135
if (not quit_now){
1633
2136
exitcode = EXIT_SUCCESS;
1634
2137
}
1635
2138
1636
2139
goto end;
1637
2140
}
1638
2141
1660
2163
1661
2164
/* Check if creating the Avahi server object succeeded */
1662
2165
if(mc.server == NULL){
1663
fprintf(stderr, "Failed to create Avahi server: %s\n",
1664
avahi_strerror(error));
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2167
avahi_strerror(error));
1665
2168
exitcode = EX_UNAVAILABLE;
1666
2169
goto end;
1667
2170
}
1675
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1676
2179
NULL, 0, browse_callback, NULL);
1677
2180
if(sb == NULL){
1678
fprintf(stderr, "Failed to create service browser: %s\n",
1679
avahi_strerror(avahi_server_errno(mc.server)));
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2182
avahi_strerror(avahi_server_errno(mc.server)));
1680
2183
exitcode = EX_UNAVAILABLE;
1681
2184
goto end;
1682
2185
}
1688
2191
/* Run the main loop */
1689
2192
1690
2193
if(debug){
1691
fprintf(stderr, "Starting Avahi loop search\n");
1692
}
1693
1694
avahi_simple_poll_loop(mc.simple_poll);
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2195
}
2196
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2199
if(debug){
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2201
(ret == 0) ? "successfully" : "with error");
2202
}
1695
2203
1696
2204
end:
1697
2205
1698
2206
if(debug){
1699
fprintf(stderr, "%s exiting\n", argv[0]);
2207
fprintf_plus(stderr, "%s exiting\n", argv[0]);
1700
2208
}
1701
2209
1702
2210
/* Cleanup things */
1719
2227
gpgme_release(mc.ctx);
1720
2228
}
1721
2229
1722
/* Take down the network interface */
1723
if(take_down_interface){
1724
/* Re-raise priviliges */
2230
/* Cleans up the circular linked list of Mandos servers the client
2231
has seen */
2232
if(mc.current_server != NULL){
2233
mc.current_server->prev->next = NULL;
2234
while(mc.current_server != NULL){
2235
server *next = mc.current_server->next;
2236
free(mc.current_server);
2237
mc.current_server = next;
2238
}
2239
}
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2244
/* Re-raise priviliges */
2245
{
1725
2246
errno = 0;
1726
2247
ret = seteuid(0);
1727
2248
if(ret == -1){
1728
perror("seteuid");
2249
perror_plus("seteuid");
1729
2250
}
1730
if(geteuid() == 0){
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
1731
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1732
2255
if(ret == -1){
1733
perror("ioctl SIOCGIFFLAGS");
1734
} else if(network.ifr_flags & IFF_UP) {
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
1735
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1736
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1737
2260
if(ret == -1){
1738
perror("ioctl SIOCSIFFLAGS -IFF_UP");
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1739
2262
}
1740
2263
}
1741
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1742
2265
if(ret == -1){
1743
perror("close");
1744
}
1745
/* Lower privileges permanently */
1746
errno = 0;
1747
ret = setuid(uid);
1748
if(ret == -1){
1749
perror("setuid");
2266
perror_plus("close");
1750
2267
}
1751
2268
}
1752
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
1753
2276
1754
/* Removes the temp directory used by GPGME */
2277
/* Removes the GPGME temp directory and all files inside */
1755
2278
if(tempdir_created){
1756
DIR *d;
1757
struct dirent *direntry;
1758
d = opendir(tempdir);
1759
if(d == NULL){
1760
if(errno != ENOENT){
1761
perror("opendir");
1762
}
1763
} else {
1764
while(true){
1765
direntry = readdir(d);
1766
if(direntry == NULL){
1767
break;
1768
}
1769
/* Skip "." and ".." */
1770
if(direntry->d_name[0] == '.'
1771
and (direntry->d_name[1] == '\0'
1772
or (direntry->d_name[1] == '.'
1773
and direntry->d_name[2] == '\0'))){
1774
continue;
1775
}
2279
struct dirent **direntries = NULL;
2280
struct dirent *direntry = NULL;
2281
int numentries = scandir(tempdir, &direntries, notdotentries,
2282
alphasort);
2283
if (numentries > 0){
2284
for(int i = 0; i < numentries; i++){
2285
direntry = direntries[i];
1776
2286
char *fullname = NULL;
1777
2287
ret = asprintf(&fullname, "%s/%s", tempdir,
1778
2288
direntry->d_name);
1779
2289
if(ret < 0){
1780
perror("asprintf");
2290
perror_plus("asprintf");
1781
2291
continue;
1782
2292
}
1783
2293
ret = remove(fullname);
1784
2294
if(ret == -1){
1785
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1786
strerror(errno));
2295
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2296
strerror(errno));
1787
2297
}
1788
2298
free(fullname);
1789
2299
}
1790
closedir(d);
2300
}
2301
2302
/* need to clean even if 0 because man page doesn't specify */
2303
free(direntries);
2304
if (numentries == -1){
2305
perror_plus("scandir");
1791
2306
}
1792
2307
ret = rmdir(tempdir);
1793
2308
if(ret == -1 and errno != ENOENT){
1794
perror("rmdir");
2309
perror_plus("rmdir");
1795
2310
}
1796
2311
}
1797
2312
1802
2317
&old_sigterm_action,
1803
2318
NULL));
1804
2319
if(ret == -1){
1805
perror("sigaction");
2320
perror_plus("sigaction");
1806
2321
}
1807
2322
do {
1808
2323
ret = raise(signal_received);
1809
2324
} while(ret != 0 and errno == EINTR);
1810
2325
if(ret != 0){
1811
perror("raise");
2326
perror_plus("raise");
1812
2327
abort();
1813
2328
}
1814
2329
TEMP_FAILURE_RETRY(pause());
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0